Path Confusion Vulnerability in Envoy Proxy by Envoy Technologies
CVE-2026-73551
What is CVE-2026-73551?
The Envoy Proxy has a vulnerability that arises from improper URL normalization. Specifically, it does not properly handle dot and dotdot path segments that include semicolon parameters. This oversight can lead to a situation where a request like /user/..;foo=bar/admin is not normalized to /admin, allowing for potential path confusion. The lack of canonicalization could lead to difficulties in enforcing path-based security policies due to differences in how upstream services interpret the path. Security measures may be circumvented if a remote client exploits this behavior. Versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1 have addressed this issue, ensuring proper normalization processes.
Affected Version(s)
envoy < 1.36.10 < 1.36.10
envoy >= 1.37.0, < 1.37.6 < 1.37.0, 1.37.6
envoy >= 1.38.0, < 1.38.4 < 1.38.0, 1.38.4